diff --git a/README.md b/README.md
index 3586fe3..c18560f 100644
--- a/README.md
+++ b/README.md
@@ -7,12 +7,13 @@ Crussell is a **full‑stack application** that powers a nail‑bar / salon book
 ```
 Crussell/
 ├─ backend/            # Go 1.22 + chi router API
-├─ frontend/           # SvelteKit SPA
+├─ frontend/           # SvelteKit 5 SPA (static build)
 ├─ sabredav/           # PHP + Composer for DAV
 ├─ nginx/              # Nginx reverse‑proxy for HTTP & HTTPS
 ├─ init-scripts/       # PostgreSQL init SQL
 ├─ compose.yml         # Docker‑Compose definition
 ├─ local-dev.sh        # Development helper using tmux
+├─ local-dev-2.sh      # Enhanced seeding script with more test data
 └─ README.md
 ```
 
@@ -22,7 +23,7 @@ Crussell/
 |------|---------|
 | Docker & Docker‑Compose | ≥ 20.10 |
 | Go | ≥ 1.22 |
-| Node ≥ 18 | `npm` |
+| Node | ≥ 18 (npm) |
 | tmux | ≥ 3.0 |
 
 > **Tip**: If you already have Docker Desktop or Docker Engine installed, you are good to go.
@@ -65,7 +66,7 @@ chmod +x local-dev.sh
 
 The script performs the following steps:
 
-1. **Docker checks** – starts Docker if it isn’t already running.
+1. **Docker checks** – starts Docker if it isn't already running.
 2. **PostgreSQL reset** – removes the old volume and starts a fresh container.
 3. **tmux session** – creates `crussell-dev` with panes:
    * `psql` console
@@ -92,7 +93,7 @@ The binary is then copied into the Docker image via the `Dockerfile`.
 ```bash
 cd frontend
 npm ci
-npm run build   # Production build
+npm run build   # Production build (static)
 npm run dev     # Development server
 ```
 
@@ -107,11 +108,13 @@ SabreDAV is bundled with PHP‑FPM and Composer.  The Docker image installs depe
 | `POSTGRES_USER` | DB username | `myuser` |
 | `POSTGRES_PASSWORD` | DB password | `mysecret` |
 | `POSTGRES_DB` | DB name | `mydb` |
-| `JWT_SECRET_KEY` | HMAC key for JWT | `supersecret` |
+| `JWT_SECRET_KEY` | HMAC key for JWT (HS256) | `supersecret` |
 | `SABRE_DAV_*` | Optional SabreDAV overrides | – |
 
 Create a `.env` file in the project root based on the provided `.env.example`.
 
+> **Note**: JWT tokens expire after 30 days. Login is rate-limited to 1 attempt per 5 seconds.
+
 ## 📊 Seeding Data
 
 The `local-dev.sh` script automatically seeds:
@@ -120,6 +123,16 @@ The `local-dev.sh` script automatically seeds:
 * Regular user (`user@example.com` / `password`)
 * Six example nail‑bar services
 
+The enhanced `local-dev-2.sh` script provides additional test data including:
+
+* Multiple users with different roles and account types
+* Working hours configurations
+* Exceptional working hours groups (holiday schedules)
+* Sample bookings with various statuses
+* Payment records
+* Admin notifications
+* User referrals
+
 If you want to seed manually, use the provided `init-scripts/init-script.sql` and your favourite Postgres client.
 
 ## 📌 Useful Commands
@@ -141,4 +154,204 @@ docker compose exec backend sh
 
 ---
 
+## 🏗️ Implementation Status
+
+### ✅ Complete
+
+| Feature | Backend | Frontend | Notes |
+|---------|---------|----------|-------|
+| JWT Authentication | ✅ | ✅ | Login, register, middleware; HS256, 30-day expiry |
+| Booking CRUD | ✅ | ⚠️ | Backend complete; frontend submit is stub (logs only) |
+| Admin Endpoints | ✅ | ✅ | Services, users, today view, notifications |
+| Scheduling System | ✅ | ✅ | Default hours, exceptional hours, working/available hours |
+| Holiday Hours | ✅ | ✅ | Integrated in all 3 booking flows |
+| Loyalty Backend | ✅ | ❌ | DB schema ready, no frontend component |
+| VAT System | ✅ | ❌ | `get_vat_return_data()`, `calculate_vat()` functions exist |
+| User Referrals | ✅ | ❌ | `user_referrals` table, backend logic exists |
+
+### ⚠️ Partially Complete
+
+| Feature | Status | Details |
+|---------|--------|---------|
+| Notifications | Backend only | Admin notifications wired; no frontend panel, no push (email/SMS), no regular user notifications |
+| GDPR Compliance | DELETE only | `anonymize_user()`, `export_all_user_data()` exist but only DELETE is wired to endpoint |
+| Analytics | Handler exists | `handlers/admin/analytics.go` exists but NOT wired in router |
+
+### ❌ Not Wired (Handlers Exist)
+
+| Handler | File | Notes |
+|---------|------|-------|
+| Social Auth | `handlers/auth/social.go` | OAuth integration placeholder |
+| Analytics | `handlers/admin/analytics.go` | Statistics/dashboard endpoint |
+| Portfolio Images | `handlers/portfolio/images.go` | Gallery management |
+| RefreshTokenHandler | `handlers/auth/local.go:322` | Token refresh endpoint |
+
+### 🚧 Critical TODOs
+
+| Location | Issue | Priority |
+|----------|-------|----------|
+| `BookingFlow.svelte:600` | `submitBooking()` only logs, needs POST implementation | High |
+| `BookingCreateModal.svelte:224` | Remove `console.log(users)` debug statement | Low |
+| `/api/users/guest` | Guest endpoint for walk-ins not implemented | Medium |
+| GDPR Export | Need endpoint for `export_all_user_data()` | Medium |
+| Tax Export | Endpoint for VAT return data export | Medium |
+
+### 📋 Feature Requests
+
+| Feature | Description |
+|---------|-------------|
+| One-off Custom Services | Allow creating single-use services not in regular catalog |
+| One-off Exceptional Hours | Single-day overrides without creating a group |
+| Auto Lunch Protection | Prevent booking during lunch hours automatically |
+
+---
+
+## 🔄 Booking Flows
+
+Crussell supports **three distinct booking flows**:
+
+| Flow | User | Entry Point | Status |
+|------|------|-------------|--------|
+| Self-Service | Customer | `BookingFlow.svelte` → `/api/bookings` | ⚠️ Stub submit |
+| Walk-In | Admin | Admin panel → walk-in modal | ✅ |
+| Call/Message-In | Admin | Admin panel → booking modal | ✅ |
+
+All three flows integrate with the **holiday/exceptional hours** system to prevent bookings during closed periods.
+
+---
+
+## 🔍 Helpful Greps
+
+### All Three Booking Flows
+
+**Backend - All Booking Creation Endpoints:**
+```bash
+grep -rn "func.*Create.*Booking\|func.*WalkIn\|func.*Walk.*In\|POST.*booking" backend/handlers/ --include="*.go"
+```
+
+**Frontend - All Booking Flow Components:**
+```bash
+grep -rln "BookingFlow\|WalkIn\|walk-in\|call.*in\|message.*in" frontend/src/lib/components/ --include="*.svelte"
+```
+
+**Combined - Single View of All Booking Flows:**
+```bash
+grep -rn "CreateBooking\|CreateWalkIn\|BookingFlow\|submitBooking" backend/ frontend/ --include="*.go" --include="*.svelte"
+```
+
+### Database Schema
+
+**All Enums:**
+```bash
+grep -n "CREATE TYPE" init-scripts/init-script.sql
+```
+
+**All Tables:**
+```bash
+grep -n "CREATE TABLE" init-scripts/init-script.sql
+```
+
+**All Functions:**
+```bash
+grep -n "CREATE OR REPLACE FUNCTION" init-scripts/init-script.sql
+```
+
+### Router Endpoints
+
+**All Wired Routes:**
+```bash
+grep -n "r\.\(Get\|Post\|Put\|Delete\|Patch\)" backend/main.go
+```
+
+**Middleware Chain:**
+```bash
+grep -n "r\.Use\|r\.Group" backend/main.go
+```
+
+### Authentication
+
+**JWT Middleware:**
+```bash
+grep -rn "JWTMiddleware\|VerifyToken\|ParseToken" backend/ --include="*.go"
+```
+
+**Protected Routes:**
+```bash
+grep -n "r\.Group.*Auth" backend/main.go
+```
+
+### Holiday/Exceptional Hours
+
+**Usage Across All Flows:**
+```bash
+grep -rn "exceptional.*hours\|holiday.*hours\|getExceptional\|getHoliday" backend/handlers/ frontend/src/ --include="*.go" --include="*.svelte"
+```
+
+### Notifications
+
+**Admin Notifications:**
+```bash
+grep -rn "admin_notifications\|AdminNotification" backend/ --include="*.go"
+```
+
+**Notification Reasons (Enum Values):**
+```bash
+grep -A10 "admin_notification_reason" init-scripts/init-script.sql
+```
+
+### GDPR Functions
+
+**Data Export/Anonymization:**
+```bash
+grep -rn "anonymize_user\|export_all_user_data\|delete_guest_user" backend/ --include="*.go" init-scripts/
+```
+
+### Frontend Debug Artifacts
+
+**Console Logs to Remove:**
+```bash
+grep -rn "console\.log" frontend/src/ --include="*.svelte" --include="*.ts"
+```
+
+---
+
+## 🗄️ Database Schema Overview
+
+### Enums
+
+| Enum | Values |
+|------|--------|
+| `account_role` | `user`, `admin` |
+| `account_type` | `standard`, `vip`, `guest` |
+| `booking_status` | `pending`, `confirmed`, `in_progress`, `completed`, `cancelled`, `no_show` |
+| `payment_type` | `deposit`, `full`, `refund` |
+| `payment_method` | `cash`, `card`, `bank_transfer`, `square` |
+| `payment_status` | `pending`, `completed`, `failed`, `refunded` |
+| `admin_notification_reason` | `pending_booking`, `cancelled_booking`, `rescheduled_booking`, `1_week_no_pay`, `1_month_no_pay`, `affiliate_claim` |
+
+### Key Tables
+
+| Table | Purpose |
+|-------|---------|
+| `users` | Customer and admin accounts |
+| `services` | Salon service catalog |
+| `bookings` | Appointment records |
+| `booking_services` | Services per booking (many-to-many) |
+| `payments` | Payment transactions |
+| `working_hours` | Default weekly schedule |
+| `exceptional_working_hours_groups` | Holiday/special schedules |
+| `admin_notifications` | Admin alerts |
+| `user_referrals` | Referral tracking |
+
+### Validation Rules
+
+| Field | Rules |
+|-------|-------|
+| Names | 1-50 chars, unicode letters/spaces/hyphen/apostrophe/dot |
+| Phone | UK format → E.164 (+44...) |
+| Age | Must be 16+ years |
+| Login Rate Limit | 1 attempt per 5 seconds |
+
+---
+
 **Happy coding!**
diff --git a/frontend/README.md b/frontend/README.md
deleted file mode 100644
index 75842c4..0000000
--- a/frontend/README.md
+++ /dev/null
@@ -1,38 +0,0 @@
-# sv
-
-Everything you need to build a Svelte project, powered by [`sv`](https://github.com/sveltejs/cli).
-
-## Creating a project
-
-If you're seeing this, you've probably already done this step. Congrats!
-
-```sh
-# create a new project in the current directory
-npx sv create
-
-# create a new project in my-app
-npx sv create my-app
-```
-
-## Developing
-
-Once you've created a project and installed dependencies with `npm install` (or `pnpm install` or `yarn`), start a development server:
-
-```sh
-npm run dev
-
-# or start the server and open the app in a new browser tab
-npm run dev -- --open
-```
-
-## Building
-
-To create a production version of your app:
-
-```sh
-npm run build
-```
-
-You can preview the production build with `npm run preview`.
-
-> To deploy your app, you may need to install an [adapter](https://svelte.dev/docs/kit/adapters) for your target environment.